CVE-2021-34702

Estado: ModificadaMedia (4.3)—

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to improper enforcement of administrator privilege levels for low-value sensitive data. An attacker with read-only administrator access to the web-based management interface could exploit this vulnerability by browsing to the page that contains the sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Puntuación base: 4.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.87%
Percentil entre todas las CVEs puntuadas: 58
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Identity Services Engine

CWE

CWE-200
NVD-CWE-Other

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2021-34702",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-34702",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-07T21:40:02.356809Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Identity Services Engine Software",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-06T20:15:08.777",
  "references": [
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disc-pNXtLhdp",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disc-pNXtLhdp",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to improper enforcement of administrator privilege levels for low-value sensitive data. An attacker with read-only administrator access to the web-based management interface could exploit this vulnerability by browsing to the page that contains the sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administración basada en web de Cisco Identity Services Engine (ISE) podría permitir a un atacante remoto autenticado conseguir información confidencial. Esta vulnerabilidad es debido a una aplicación inapropiada de los niveles de privilegio de administrador para los datos confidenciales de bajo valor. Un atacante con acceso de administrador de sólo lectura a la interfaz de administración basada en web podría explotar esta vulnerabilidad al navegar a la página que contiene los datos confidenciales. Una explotación con éxito podría permitir al atacante recoger información confidencial sobre la configuración del sistema"
    }
  ],
  "lastModified": "2026-06-17T03:56:22.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81CD2CC9-C89D-493B-815E-77308CFD28A4",
              "versionEndExcluding": "2.6.0",
              "versionStartIncluding": "2.2.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B45856E-6BE4-40A7-AE2F-4F9DC9315875"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F6D1780-3306-4481-A3CD-8F7732D955CC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00756651-F667-4E4A-8024-3EAF003A9B92"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07BF9702-0607-49A1-A82A-E4ADF1A4135F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11AA4EC0-6F3C-45A9-9AA4-0D81876F44B5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B4B88F0-3229-4B07-9308-C37C794595A0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E02F0E61-FBFF-4C6D-9132-E266FF67802B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "541EC483-540A-4080-AA69-82A0F30EE3D6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66CAFE97-295F-48F7-A92C-A90D3B837483"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68E172B4-867E-4413-9D45-F04B52270D41"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F22FABF-2831-4895-B0A9-283B98398F43"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B83D0F20-5A43-4583-AFAF-CD9D20352437"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2887A2C0-BADA-41D3-AA6A-F10BC58AA7F9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5ADE32BD-C500-47D8-86D6-B08F55F1BBDF"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22F23314-96BE-42F6-AE07-CC13F8856029"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1063044-BCD7-487F-9880-141C30547E36"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA42E65A-7207-48B8-BE1B-0B352201BC09"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75DDAF38-4D5F-4EE4-A428-68D28FC0DA96"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}